How to Protect Your Accounts from Phishing and Stolen Passwords

Phishing attacks and stolen passwords are the leading causes of account takeovers, but you can block most of them with a few straightforward habits. This guide walks you through the exact steps to secure your email, social media, banking, and work accounts—from creating strong passwords to spotting fake login pages—so you can reduce your risk without needing to be a tech expert.

What You’ll Need

A password manager (free options like Bitwarden or built-in ones in browsers are fine)
A smartphone with an authenticator app (Google Authenticator, Microsoft Authenticator, or your phone’s built-in security key feature)
Access to the email account you use for account recovery (make sure it’s one you check regularly)
About 30–60 minutes to set everything up

Step-by-Step

Turn on two-factor authentication (2FA) on every important account. Start with your email, banking, social media, and any work accounts. Go to each account’s security settings, look for “Two-Step Verification” or “2FA,” and choose an authenticator app over SMS whenever possible. SMS is better than nothing, but app-based codes are more secure because they can’t be intercepted by SIM-swapping.
Use a password manager and generate unique passwords. Stop reusing passwords. A password manager (like Bitwarden, 1Password, or the one built into your browser) stores all your passwords in an encrypted vault. Use its built-in generator to create a random 12–16 character password for each site. You only need to remember one master password.
Create a strong master password. Your master password is the key to everything. Make it at least 12 characters, use a phrase you can remember (like “BlueHorseEatingChips!”), and never write it down in plain sight. Do not use your pet’s name, birthday, or any easily guessed word.
Check for phishing red flags before entering credentials. Before typing your password anywhere, look at the URL bar. Is the site using HTTPS (the padlock icon)? Does the domain match exactly? For example, “amazon-security-alert.com” is not Amazon. Hover over links in emails—don’t click—to see where they actually lead. If an email creates urgency (“Your account will be closed in 24 hours”) or asks for personal info, treat it as suspicious.
Never click links in unexpected emails or texts. Instead, go directly to the website by typing the address yourself or using a bookmark. If your bank sends an email, open a new tab, type your bank’s URL, and log in there. This bypasses any fake link.
Update your recovery email and phone number. Make sure the email and phone number associated with each account are current. If you lose access, these are how you get back in. Use a different email for recovery than the one you use for daily logins if possible.
Set up a security key for your most sensitive accounts. If you use Google, Apple, or Microsoft, consider adding a hardware security key (like a YubiKey) or using your phone’s built-in security key feature. This is the strongest form of 2FA and blocks most phishing attacks completely, because the key only works on the real site.
Regularly review your account activity. Every few weeks, check the “recent activity” or “devices” section in your email and social media accounts. If you see a login from an unknown location or device, change your password immediately and sign out of all other sessions.
Use a separate email for financial accounts. Create a dedicated email address that you only use for banking, PayPal, and investment accounts. Don’t use it for shopping or social media. This way, even if your main email is compromised, your financial logins are harder to reach.
Keep your software updated. Enable automatic updates on your phone, computer, and browser. Updates patch security holes that phishers and malware rely on. This is a passive but critical step.

Common Mistakes

Reusing passwords. If one site is breached, attackers try the same email/password combo on every major site. This is how most “hacked” accounts happen—not through clever hacking, but through credential stuffing.
Clicking links in emails that “look real.” Phishers copy logos and formatting. Always check the URL before entering anything.
Turning off 2FA because it’s annoying. The extra 10 seconds it takes is worth it. Accounts without 2FA are significantly easier to steal.
Using security questions with public info. “What’s your mother’s maiden name?” is easily found on social media. If you must use them, give fake answers (e.g., “BlueBanana”) and store them in your password manager.
Entering passwords on public Wi-Fi. A rogue hotspot can capture your credentials. Always use a VPN or your phone’s hotspot when on unfamiliar networks.

Tips

Use a passphrase instead of a password. “CorrectHorseBatteryStaple” is far stronger than “P@ssw0rd!” and easier to remember.
Enable automatic sign-out after inactivity. This limits exposure if your device is stolen.
Use your browser’s password breach alerts. Chrome, Firefox, and Safari can warn you if your saved passwords appear in known data breaches. Act on those warnings immediately.
Set up a “sign in with Google/Apple” option where available. This avoids creating a new password for each site and relies on the security of your main account.
Back up your 2FA codes. When you set up an authenticator app, it gives you recovery codes. Save them in your password manager or a secure offline location. If you lose your phone, these are your only way back in.

Troubleshooting

What if I already clicked a phishing link and entered my password?

Act immediately: change that password on the real site, then change it on any other site where you used the same password. Enable 2FA if you haven’t. Check your account activity for unauthorized logins and sign out of all sessions. If it’s a financial account, contact the institution’s fraud department.

What if I can’t log in because I forgot my 2FA code?

Use your recovery codes (you saved them, right?). If you didn’t, most services offer a backup method via SMS or email. If that fails, you’ll need to go through the account recovery process, which may take a few days. That’s why recovery codes are so important.

What if my password manager is locked and I forgot the master password?

Most password managers have a recovery option if you set it up (like a recovery key or a trusted device). If not, you may lose access to your vault. This is a good reason to write your master password on a piece of paper and store it in a safe place—yes, paper is fine if it’s physically secure.

What if I’m getting endless phishing emails?

Don’t click “unsubscribe”—that confirms your email is active. Instead, mark them as spam and delete. If it’s persistent, consider changing your email address for important accounts.

Frequently Asked Questions

Q: Is SMS 2FA better than nothing?
A: Yes, but it’s vulnerable to SIM-swapping. Use an authenticator app or hardware key if possible.

Q: How often should I change my passwords?
A: Only when you suspect a breach, or when a service tells you to. Frequent forced changes often lead to weaker passwords. Focus on unique passwords and 2FA instead.

Q: Can a phishing email install malware without me clicking?
A: No, just opening an email is safe in most modern email clients. The danger comes from clicking links or downloading attachments. Don’t open attachments from unknown senders.

Q: What’s the safest way to store my 2FA recovery codes?
A: In your password manager’s secure notes, or printed on paper kept in a locked drawer. Avoid storing them in plain text on your phone’s notes app.

Q: Should I use a separate password for every site, even low-value ones?
A: Yes, because attackers use breaches from low-value sites to access high-value ones. A password manager makes this easy.

Q: What does a phishing URL actually look like?
A: It often has a misspelling (e.g., “faceb00k.com”) or a subdomain (e.g., “facebook.com.login-help.info”). Always check the part right before the .com or .org—that’s the real domain.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →